Privacy Statement

Last updated: 5 November 2026

This privacy statement applies to the Android app “WallboxControl” (German: “Wallbox-Steuerung”). For this website and the forum, the website privacy statement applies.

1. Controller

Christian Kaiser, Höhrenbergstr. 10, 78476 Allensbach, Germany
Email: android_app_support@chk.digital
More details in the legal notice.

2. In short

  • The app runs on your Android device and controls your wallbox, PV system, home storage and car from there. It keeps settings, readings, statistics and logs on the device.
  • The app contains no ads, no tracking and no usage analytics.
  • Data only leaves the device in the cases described below, almost always because you set up a feature that needs it.
  • Data that can reach me is covered in sections 8 (remote control) and 10 (logs, crash reports, feedback).

3. Credentials

Passwords you enter for your devices, your car and online services are stored on the device in encrypted form (AES-256). The key is generated at random on installation and is also kept on the device, so that a backup can be restored on another device (see section 9).

4. Devices in your home network

Wallboxes, inverters, meters and storage systems that you connect locally (Wi-Fi/LAN, Modbus, MQTT, HTTP) are addressed directly within your home network. No data leaves your network in that case. An MQTT broker or WebDAV server you enter yourself is run by you or your provider; the app then sends the data there.

The app also needs the “Location” and “Nearby devices” permissions for this: Android only reveals the name of the Wi-Fi network with location permission. The app uses it to tell whether the device is on your home Wi-Fi, and searches for devices there. The network name and the devices found stay on the device.

5. Manufacturer clouds and services you choose

If you connect a device via its manufacturer’s cloud, or query your car’s state of charge (SoC) from the manufacturer’s portal or a data service, the app sends your credentials or tokens to that provider and retrieves readings and vehicle data from there, for example power values, state of charge, range and vehicle identification number (VIN). The connection runs directly between your device and the provider; I do not receive this data. The privacy policy of the respective provider applies.

6. Location, weather and PV forecast

For sunrise and sunset, weather and the PV forecast the app needs the approximate location of your system. It asks the device for it with coarse accuracy, or you enter it manually. The coordinates are stored rounded to two decimal places (about 1 km). The place name is looked up by the Android system’s geocoder, which on most devices is a Google service.

If the device knows no location and none is stored, the app estimates it from your IP address using ip-api.com. Only the IP address is transmitted (the request is unencrypted). The result is often inaccurate, so granting location permission or entering the location manually is worthwhile.

The app fetches weather data with the rounded coordinates from one of these services:

7. Electricity prices and grid signals

  • Exchange prices (EPEX): from the ENTSO-E Transparency Platform. Only the bidding zone is transmitted.
  • Price forecasts: from energyforecast.de or epexpredictor.batzill.com. Only the market zone is transmitted.
  • StromGedacht: your postcode is transmitted because the forecast is regional (StromGedacht privacy policy).
  • Tibber: your Tibber token or Tibber login is transmitted; Tibber uses it to provide your prices and, if you wish, your car’s state of charge.

8. Remote control (optional)

Remote control lets you operate the app from a second device. It uses Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Only if you set up remote control does the app store there:

  • for signing in, your email address and password (Firebase Authentication; Google stores the password only as a hash),
  • the current state of the control: wallbox, grid, PV and storage values, the car’s state of charge and VIN, statistics, electricity prices, notifications, control commands, the rounded location and charts as images,
  • for push messages between your devices, a device token (Firebase Cloud Messaging) with device ID, role (server or client) and app version.

To prevent abuse, the app uses Firebase App Check (Google Play Integrity) to verify that requests come from the genuine app.

Independently of remote control, the app registers with Firebase on startup so that push messages can be delivered. Google assigns a random installation ID and a device token; neither contains any personal details. The token is only stored on my side if you use remote control.

The realtime database is located in the EU (Belgium); push messages are relayed in Frankfurt. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Privacy information: Firebase, Google.

As operator of the Firebase project I technically have access to this data. I only look at it if you ask me to when you have a problem. “Delete account” in the remote control setup deletes the account and all data stored for it. Other devices using the same account can still write data for up to an hour afterwards; this is deleted automatically about an hour later as well. If you deleted your account with an older version of the app, write to me and I will delete the remaining data.

9. Backup (optional)

If you set up a backup, the app uploads it to the storage you choose: Dropbox (privacy), Google Drive (privacy) or your own WebDAV server. For Dropbox and Google Drive you sign in directly with the provider; the app only receives an access token, not your password.

The backup contains all settings and databases of the app, including the encrypted credentials and the key to them. Protect the account it is stored in accordingly. I have no access to the backup.

10. Debug log, crash reports and feedback

  • Debug log: Only if you switch it on does the app write a detailed log on the device. It contains technical details such as IP addresses, device responses and readings; for some devices also credentials in plain text, if they are transmitted that way. The log only leaves the device if you send it to me: as an email attachment via your mail app, or uploaded to your Dropbox or Google Drive with a link by email. I use it only for troubleshooting and delete it once the problem is resolved. You can delete it on the device under “About…” → “Debug Information”.
  • Crash reports: After a crash the app asks whether to send a report. Only if you agree does it open your mail app with a report to me: Android version, device model, error message with stack trace, the app’s system log and your comment. Settings and passwords are not included.
  • Feedback: “Feedback” under “About…” opens your mail app. The app appends an overview of the configured devices and information about the app; you can delete this before sending.

11. Google Play

Purchases and subscriptions are handled by Google Play. I do not receive any payment data. Notices about new versions and the request for a rating also come via Google Play. Google’s privacy policy applies.

12. Version notes

While the app is open, it downloads a small text file with version notes from pub.chk.digital at most once per hour. This only results in the usual access logging with IP address at the web host (STRATO).

13. Legal bases

  • Art. 6(1)(b) GDPR: providing the features you use (sections 4 to 9 and 11)
  • Art. 6(1)(a) GDPR: your consent when you send logs, crash reports or feedback (section 10)
  • Art. 6(1)(f) GDPR: legitimate interest in a working app protected against abuse (location estimate from the IP address, Firebase registration on startup, App Check, version notes)

14. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time with effect for the future. Just write to the address above. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.